Personal

Back in mid 2009, I discovered an unexpected shipping confirmation in my e-mail inbox. It was sent from my cellphone service provider, and was letting me know that the iPhone I ordered had been sent out to me. Thing is, I never ordered an iPhone, and though the confirmation showed my name, it was being shipped to another address, and was associated with another phone number. It didn’t take long for me to realize that this was identity theft.

I immediately called my provider, and realized that I would likely have problems authenticating with them. You see, the provider usually asked for two key items whenever I called: birth date, and postal code. Anticipating this, I first told the agent the situation, and he confirmed that the address and contact information on my account had been changed. Since I had the thief’s information as well, I was able to prove that I was legitimate, and the agent told me I’d have to call the fraud department, which was currently closed.

As a next step, I returned to the confirmation e-mail, and took note of the shipping information in there. It was being shipped by one specific package delivery company, and I had a tracking number. Seeing as it was late, I couldn’t call their hotline for help. Instead, I went ahead and sent an e-mail to their support, warning them that the package should not be delivered, as it was fraudulent. I realized that I would likely not hear back from them that night, but at least I knew I did something while waiting for the hotline to open the next morning.

The next day, I called my cell phone provider first, and spoke with their fraud department. From what they could tell, the thief simply managed to authenticate as me, providing my birth date and postal code. He then had them change the address and phone number on my account, likely after telling them he had moved. As a means of protecting my account from further break-ins, the provider offered to set up a password. I naturally agreed to this, but wondered why it wasn’t active by default.

Next in line was the delivery company, which I managed to reach by phone. The agent mentioned that the package was already in transit, and that she would notify the driver to abort the delivery. She seemed fairly confident that this would occur, so I was in a good position by the end of the call. Keep in mind, though, that I probably didn’t need to worry about the delivery, as the provider likely had insurance for such situations. My pursuit, at that point, was mainly for personal reasons – if I could stop the thief from succeeding, I would be much more satisfied.

Soon after completing the calls, I arrived at work, and told my boss the story. He naturally allowed me to deal with it from the office, rather than work. Since I had spoken to the delivery company and my cell phone provider, the next step was to call the police. I explained my story, and the officer told me someone would call me back to discuss it further. In the meantime, her advice was that I should activate a fraud alert on my credit line, which I went ahead and did immediately after the call. The alert would prevent anything from being charged to my name, effectively making a social security number a requirement in all large credit purchases. After activating the alerts, I went back to my desk, and tried to piece together how exactly I had been compromised. Within a few minutes, I had my answer.

To find my postal code, the thief probably just ran a WHOIS against my domain. At the time, I had multiple domains, and each one had been registered using my full name, address, and phone number. Domain registrations are public records, and though it’s a security concern, the contact information is needed to prove ownership. While this isn’t immediately visible to everyone, with the right tools, one can access that information. As an example, visit this website, and enter “microsoft.com” in the WHOIS box. Press “WHOIS >>” when ready, and then scroll down to see the registration information. There are hosts that offer private registration, usually for an additional fee, but at the time, my host didn’t have the option.

Now, on the other hand, my birth date was a little less straight-forward. It was a coworker who initially found that my Amazon wishlist was available to the public, and it revealed my birth day and month. While the year wasn’t actually revealed, there are many sites where my current age is displayed. With that, the year can be deduced, and there you have it – the date of my birth, cracked.

With the security holes revealed, I decided to correct the easiest one – I disabled my Amazon wishlist. The domain problem would have to be addressed later, as it would likely require changing hosts, which was not a quick task. My next goal was to find out as much as I could about the thief, as I had his address and phone number. After some googling, I located the Facebook profile of the supposed culprit, which of course included his name. Unfortunately, I couldn’t determine if he was the actual thief, or a scapegoat, so I couldn’t act on this knowledge. The actual thief could simply have given that address with the intention of being there just in time to grab the delivery. So, instead of acting on it, I took notes, and awaited the police phone call.

A few minutes later, I got word from the delivery company – they had successfully blocked the package, and it was being returned to the sender. With this news, I knew that I had blocked the thief – it was now simply a matter of bringing down the hammer of justice. Soon after, the police called back, and I explained my story once more. To my surprise, I was told that there was nothing they could do to locate the individual, despite the information I had collected. Apparently, the scam was fairly common, and the person doing it was most likely not the one at the address. The officer then explained that it would have been a different story if I hadn’t successfully blocked the delivery. Even then, I was told it would have taken the police department ONE YEAR to investigate such a theft. I left the call feeling less respect for the police, and seriously considered taking a vigilante approach.

Despite my disappointment in the police, the problem had been mostly resolved. I successfully prevented the thief from getting anything, and my accounts were now all protected. I had called all companies I did business with, and had them activate all optional security measures.

Two weeks after the incident, I received yet another e-mail, notifying me that my password had been reset on my account. I once again called my cellphone provider’s fraud department, and they helped me piece together what happened. The thief probably noticed he hadn’t received the iPhone, and tried to get that corrected by going to a store in person. When he couldn’t figure out the password that was being asked of him, he likely claimed he had forgotten it, and had the agent reset it. Since my account had the correct contact information, the new password was sent to my e-mail address. Since he couldn’t get into the account, and couldn’t check my e-mail, he was officially stuck, and the conflict finally came to an end…. I had won.

However stressful, the whole experience proved instrumental in improving my security on the web. No longer could I just casually open accounts everywhere, worry-free. I now had to be very conscious of how websites intended to use my data, otherwise, I could be leaving bits of information for thieves to exploit. I once wrote an article that explains how I would google my own e-mail address to see if it was visible to spammers. Well, the same approach can be used for other things – you can google your name, address, phone number, and see if it is exposed anywhere. Keeping in mind, of course, that after searching for anything sensitive, you should probably wipe your browser history, as well as your Google Web History, if you have that activated.

Beyond making sure that websites don’t expose too much information about me, I also try to avoid being specific in my posts. You likely noticed that I never mentioned who my cellphone provider was, and who the package delivery company was. I do this to make sure I’m not giving away details that can be used against me. I also exclude certain facts from my posts so that if my identity is ever in question, I have unique information that can set me apart from the thief. I do something similar with the images that I upload to this blog – if I spot anything even remotely sensitive, I’ll cover it up.

So, that’s my story, folks – hopefully my experience will prove useful in preventing similar attempts on others.

Photo credit

First photo by Ken Banks, kiwanja.net.

Second photo by KDavidClark.

Third photo by Tim Pierce.

Ah, yes, Livemocha. If you haven’t heard, Livemocha is a site that allows you to learn languages with the help of a community. While it does offer exercises and quizzes that are similar to Rosetta Stone, the most powerful feature is the fact that other users review your submissions. That alone is worthy of a recommendation, so check it out if you haven’t already. The community support goes a long way towards motivating a person, and also ensures only native speakers of a language are the ones reviewing. This idea is a very powerful one, but unfortunately, the interface that they offer – the website – is flawed in many ways. Today, I’d like to share my experiences with one of these flaws, which, in my opinion, is a major usability issue.

Consider this Livemocha e-mail notification:

Alright, so “maxwevictor96” sent me a message. The name is a bit weird, so I’m pretty sure it is spam – but there’s no way for me to read the message content from the inbox. If I click on the link, I’m forced to log into Livemocha before I’m allowed to see the content. Seeing as Livemocha also offers paid learning services, I can see why they might want us to log in as often as possible. After all, the more time we spend on the site, the more time we have to consider paying for advanced services. Of course, I’m just speculating – it’s possible they didn’t intentionally design it with that in mind.

Anyway, provided I do log in, I’m brought to the message:

So, yeah, definitely spam, and it’s up to me to either flag it, or ignore it completely. In an effort to improve the services that I use, I usually go out of my way to flag spam. Notice the Report abuse button on the left? Seems clear enough, so let’s click that.

A gray overlay appears over the site, and after about 2 seconds of loading, the above dialog appears. So far, I can’t really complain – apart from the long load time. The form seems pretty standard, so I select Spam from the Category dropdown, and click Submit.

Instead of the dialog disappearing, an error message appears, telling me that the “Message cannot be blank“. Apparently, saying the e-mail is spam is not enough. I actually have to type something in the comments box… but what do they want me to enter at this point? The first few times, I wrote “This is spam”, what else do they expect? Seems to me that the form should not require comments if you’re simply flagging spam. After doing this on many separate occasions, and cursing at the unknown designer that came up with this process, I actually caught myself adding random characters to the Comments textbox, just so I could submit quickly. In other words, I spammed the report spam feature, to save time – all because of this bizarre design choice. It reminds me of the Windows Server 2003 dialog that appears whenever you boot, where you have to explain why the machine was taken offline. Sure, it can be useful in specific environments, but for a simple test machine – I really don’t care when it goes offline, so I learned to enter random garbage into that textbox just to get past it. Funny how design choices can turn well-intentioned users into annoyed pseudo-spammers.

Anyway, provided you spend time entering something in the comments box, you can successfully click Submit. Then, this message appears:

I get thanked for keeping Livemocha clean, and it tells me my report has been submitted successfully. Okay, fine – then I’m told the dialog will disappear in 5 seconds, so I don’t need to do anything. They offer a small close button, but it’s far enough away from where my mouse cursor is (after clicking Submit) that I never actually felt like it was worth it to try and close the window early. If at least they would count clicks outside the dialog, I could hide it immediately by clicking the gray zone. But no, instead, I’m subject to time-limited target practice – if I can click the little Close button quick enough, I can save maybe 2-3 seconds. That, or sit idly and let the 5 seconds elapse – after all, once you’ve read the message one time, there’s really no value in re-reading it.

So why do you feel the need to waste my time, Livemocha? I lose 2 seconds waiting for the dialog to appear, then I have to select Spam, enter redundant information in the comments box, click Submit, and then wait 5 more seconds. I have a suggestion, guys – how about a Report Spam button with no questions asked?

Update: I posted a feature request on LiveMocha’s feedback site.

Back in 2007, my MattRefghi.com domain served primarily to power my solo development experiments. Behind the scenes, it was hosted by 1&1 Internet – the price was low, which was necessary at the time. All was well in the world of 1&1 web hosting for a while, until I eventually encountered a problem when uploading PHP files to my server. When I ran the files on MattRefghi.com, they would fail – but on my local development machine, everything was working as expected.

Eventually I called their tech support team to see if something was wrong with their configuration. The agent helped me resolve the problem, but in the process of doing so, he started modifying my PHP files – without even asking me. During the call, I didn’t really think much of it, particularly since the code I had uploaded wasn’t very important to me. Ultimately, the agent’s PHP tampering helped me figure out the problem; however, after the call, I realized that his behavior was a very big concern. Had my source code actually been important, I wouldn’t have wanted anyone to get their eyes on it, let alone edit it. After a while, I contacted 1&1 to report the encounter, and express my concern in their practices. The agent that received my report was sympathetic, and assured me it wouldn’t happen again:

The issue that you reported is actually beyond the rules of 1and1
already and as tech support, we are not allowed to alter anything from
the customer’s files or account. We can assure you that if anything
like this will happen again, we will take further measures. That is
generally the reason why we do not support scripting issues. I would
like to apologize for this issue.

However, it still marked the end of my business with 1&1 – I couldn’t risk my code being comprised. Apology or not, their hiring practices produced at least one agent with insufficient training.

Seeking more stability and a trustworthy host, I went ahead and signed up with Yahoo Web Hosting. It was more expensive, but it had something important – a big name I felt I could trust. Surely, Yahoo would have better practices, and I would be safe to code away as I always had. To be fair, this was the case – I never felt my security was at stake when I was with Yahoo. I instead encountered a different type of problem:  I couldn’t figure out how to map multiple domains in such a way that they all used my MattRefghi.com web hosting, without revealing that to the end-user. After multiple attempts at solving the issue on my own, I decided I would e-mail their support team, and see if they would be able to help.

Below is one of the most frustrating conversations I’ve ever had with a support team, to the point where I felt the need to describe my problem as if it were meant for a child to understand. Before we get started, I want to highlight that there are many long e-mails included in this post – some are offered as text, others as images (to preserve formatting). Typically, whenever I show a Yahoo e-mail, feel free to read the first couple paragraphs, and then skim through the rest. Now that you’ve been warned, here’s the first e-mail I sent to Yahoo:

When I originally signed up for web hosting with Yahoo, I only bought the domain: ‘mattrefghi.com’. At that time, this was all I needed. I now have my blog hosted by Yahoo (WordPress), which is in a ‘blog’ subfolder – I see this when I’m connected via FTP.

To access my blog, I can use the following address:
http://www.mattrefghi.com/

I currently have it set up so that when I type ‘http://www.mattrefghi.com/’, it brings me to a page that says:
‘mattrefghi.com is currently experiencing difficulties – come back later.’ (I added this page just for testing).
Adding ‘blog’ to the URL, and pressing enter, brings me to my blog.

This is great… all working as expected.

Thing is, I have two other domains: ‘.com’ and ‘refghi.org’.

When I forward ‘chameleoncore.com’ to point to ‘mattrefghi.com’ using masking, I get the page I expect:
‘mattrefghi.com is currently experiencing difficulties – come back later.’
…and ‘chameleoncore.com’ is in the address bar. Great.
Now… if I add ‘blog’ to this URL, it throws me back to the same page, but keeps the ‘blog’ in the address bar. Huh?
I can even put some random junk in there and it still keeps it and throws me back to the ‘technical difficulties’ page.
This isn’t what I want.

Ideally, I’d like to be able to do the following:
Create a folder called ‘chameleoncore’ via FTP, such that typing ‘www.chameleoncore.com’ will bring me to the ‘chameleoncore’ folder by default.
If the ‘chameleoncore’ folder has a subfolder (ex: ‘projects’) on the FTP server, I want to be able to access that subfolder via the following URL:
http://www.chameleoncore.com/projects/
…while ALWAYS reflecting the current directory.

I realize this would work fine if I had chameleoncore.com as my main web hosting domain – but how can I accomplish this in my situation. When I signed up, I just bought mattrefghi.com, not knowing what my business name would be. I still don’t have that name, but the ‘chameleoncore.com’ name is somewhat related, so I wanted to try setting up the site using that domain.

Any help in this matter would be appreciated.

– Matt Refghi

As you can see, I provided a wealth of information to assist the support agent. I thought it would help ensure that my problem got solved quickly.

Hello Matt,

Thank you for writing to Yahoo! Web Hosting.

I understand that you want to forward your domain ‘chameleoncore.com’ to
a sub directory in your ‘mattrefghi.com’ account.

Mathieu, I greatly appreciate that you have forwarded your concern to us
and given me a chance to assist you with this matter.

To create a subdomain, you must already have at least one subdirectory
created in your Yahoo! Web Hosting File Manager.

To create a subdirectory:
1. Sign into your Yahoo! Web Hosting account.
2. Click on the “Manage” tab.
3. Click on the “File Manager” link in the “Tools for Managing Your
Site” section.
4. Click on the “Create Subdirectory” link.

To create a subdomain:
1. Sign in to your Yahoo! Web Hosting account.
2. Click on the “Manage” tab.
3. Locate the “Web Hosting Account Details” section.
4. Locate “Subdomains”
5. Click the “Manage” link
6. Click on the “Create Subdomain” button.
7. Type in the subdomain you would like.
8. Select the subdirectory you would like your subdomain to be
associated with, then click the “Submit” button.

Now when you type in your subdomain, the index file inside of the
associated subdirectory will be automatically loaded into your browser.

For more information on subdomains, please see:

http://help.yahoo.com/help/us/webhosting/subdomains/

You can set up domain forwarding from the Domain Control Panel.

1. Log into your Yahoo! Domains account with your Yahoo! ID and password
by clicking on the “Sign In” link at the the top of the page:

http://smallbusiness.yahoo.com/domains/

2. Click the “My Services” tab, then click on the Domain Control Panel
for the account you wish to edit.

3. Click the “Forward your Domain” link.

4. Click the “Create Forward” button.

To set up masked domain forwarding to any URL:

5. Select the “the web site at” option.

6. Enter the URL of the site to which you wish to forward your domain.
Select the masked forwarding option and click the “Submit” button.

7. Do one of the following:
* Select the option to include keywords and enter your keywords
separated by commas in the field provided.

* Select the option to not include keywords. (You can always come back
and add them later.

8. Click the “Continue” or “Submit” button.

9. Click the “Return to Domain Forward Page” button.

Regardless of which option you choose, your domain forward will appear
listed along with the details. Keep in mind that it may take up to 30
minutes for your domain forwarding to take effect during which visitors
will see the original domain and not be forwarded.

We believe this solution should resolve your issue, if it still
persists, please call us at 1-866-800-8092.

Please do not hesitate to reply if you need further assistance.

Regards,

Bradley

Yahoo! Customer Care

For assistance with all Yahoo! services please visit:

http://help.yahoo.com/

Their initial response started with an assumption – the agent, Bradley, felt he understood my problem, and provided me with lots of information about the solution. I have to admit, the instructions provided were very clear, but the e-mail, as a whole, felt like a giant form letter – and more importantly, his assumption was incorrect.  He did not correctly understand my problem, and I didn’t blame him for that – it was a tricky problem to describe. In response to this, I decided I’d write my reply as clearly as possible, while illustrating how his solution didn’t work.

After writing that e-mail, I was pretty confident they would understand what I was saying. I spent a lot of time on the formatting, making it clear beyond a doubt, and then even added color coding and smileys to convey what worked, and what didn’t. The smiley part made me laugh, but I figured if was going for clarity – I might as well crank it up to 11.

Hello Mathieu,

Thank you for writing to Yahoo! Web Hosting.

I understand that wish to hide your Yahoo! Web Hosting account domain
name “mattrefghi.com” from your website URLs.

I greatly appreciate that you not only forwarded your concern but also
shared your thoughts about the feature you’re requesting.

Mathieu, I regret that this feature is not available through Yahoo! Web
Hosting. Also, we do not have an estimated date as to when it will be
available. Currently, the feature which you wish to have is available
through URL rewrite function, unfortunately  not supported by Yahoo! Web
Hosting.

We are always looking for ways to make Yahoo! Web Hosting more useful to
our users and continually receive lot of great feedback. It is through
these comments and suggestions that we are able to make improvements.

We will be sure to keep your concern in mind to improve our service.
Moreover, I’ve also passed your comments on to our development team for
further consideration. We always have something on the drawing board,
and many of our best new features have been suggested directly by users
like you.

You can also forward your precious suggestions to us at the following
address:

hosting-suggestions@cc.yahoo-inc.com

Your cooperation and patience will be highly appreciated in this regard.
We value you as a customer and look forward to serving you for years to
come.

Please do not hesitate to reply if you need further assistance.

Have a nice day!

Regards,

Maggy

Yahoo! Customer Care

For assistance with all Yahoo! services please visit:

http://help.yahoo.com/

Despite the clear formatting, color-coding, and smileys – another Yahoo agent (Maggy) replied, wielding her own incorrect assumption. Now, it’s the approach I have a problem with – I wouldn’t mind her being wrong if she expressed her uncertainty somewhere in the e-mail. If you, the support agent, are not entirely sure that you are providing me with THE solution, don’t act like you are. Instead, she behaves as if it will solve my problem, and leaves it to the form letter to tell me I can reply, if I need further assistance.

So I reply again, and you can tell my patience is low by the last words in the e-mail:

No more canned responses, please. I’m a developer – I’m not clueless.

Then, another reply:

Hello Matt,

Thank you for writing to Yahoo! Web Hosting.

I would be pleased to assist you further.

Matt, it is not possible to switch Yahoo! Web Hosting for one domain to
another. Let me clarify the reason and basic difference between Yahoo!
Domain and Yahoo! Web Hosting.

With Yahoo! Domains plan, you register a domain which is your web
presence. You cannot host webpages under Domains plan but you can always
forward this domain to any URL.

Under Yahoo! Web Hosting plan, you get your own webspace to host
webpages. Once your Web Hosting order has been placed with a particular
domain name, it is not possible to make changes to your domain name.
During the sign-up process, we make sure to confirm your selected domain
name several times to ensure that the correct domain name will be
registered and then DNS information is propagated across all servers in
world.

Matt, you cannot transfer the hosting services from one domain to
another but you can always upgrade your Yahoo! Domains plan to Yahoo!
Web Hosting.

Steps to upgrade your Yahoo! Domains account:
———————————————–

1. Log into your Yahoo! Domains account with your Yahoo! ID and password
by clicking on the “Sign In” link at the the top of the page:

http://smallbusiness.yahoo.com/domains/

2. Click the “My Services” tab
3. Click the “Change Plan” link for the account you wish to upgrade.
4. Select from the upgrade options displayed by clicking the “Choose”
button or click the “Add New Service” link to get more information about
all of the Yahoo! Small Business products.
5. Decide upon a product upgrade and complete the order process.

NOTE: If you do not wish to keep the website with domain name
“mattrefghi.com” or do not want to host website under this name, you can
downgrade the service to Yahoo! Domains plan, free of cost.

To downgrade your Yahoo! Web Hosting account, follow these easy steps:

1. Log into your Yahoo! Web Hosting account with your Yahoo! ID and
password at:

http://smallbusiness.yahoo.com/services

2. Click on the “Change Plan” link for the domain in which you wish to
change.

3. Enter your Yahoo! ID password

4. Click in the “Choose” button of the plan on which you wish to
downgrade. or click on the “View all of our plans.” link to view more
services that are available to you.

5. Proceed through the remainder of the checkout process to switch
services.

Note: Please be aware that you are actually switching your existing
service plan. Some services that you currently enjoy may be unavailable
to you depending on the service plan selected. Please make sure to
carefully read the plan descriptions for each service option.

Matt, I hope this email will assist you in right direction.

Please do not hesitate to reply if you need further assistance.

Regards,

Shelby

Yahoo! Customer Care

For assistance with all Yahoo! services please visit:

http://help.yahoo.com/

Shelby? Alright… for the first two e-mails, I didn’t question the fact that there were two different agents. But, three? That’s getting excessive – seems like e-mails are just being randomly assigned to an owner each time I contact. It’s almost like they want their agents to “take a shot” at a solution, without opening a dialogue to ensure it is correct. After all, if their guess is right – they don’t need to have more communication with the client. Of course, if multiple e-mails are sent, each agent must read the whole history to see what didn’t work, so it’s an approach that taxes Yahoo over time.

Furthermore, this conversation was a strange case where even if I spent time making my e-mails abundantly clear, it didn’t seem to improve the experience. The agents still continued to take shots at my problem, most of which proved incorrect. In fact, because of this, I wouldn’t be completely surprised if you told me that Yahoo’s support system was fully automated, where the software actually replies to client e-mails. The only clear proof against this, to me, seems to be the Shelby e-mail, where the fist few paragraphs seem pretty human.

In the end, Shelby’s e-mail provided me with the confirmation that I needed – Yahoo requires that you buy web hosting per domain that you purchase. Can you guess what my next reply was?

I would like to cancel my web hosting plan, but still keep my domain registrations with you.

How would I go about doing that?

Transcript:

Hi guys. In this video I have two tips I’d like to share with you, and they’re dealing specifically with how to make the properties dialog appear faster in Windows. You’re probably all familiar with right-clicking files in Windows and selecting Properties. What I’d like to show you is a quicker way of doing that – two quicker ways of doing that, actually.

The first way involves hovering your mouse over any file on the desktop or anywhere else in Windows, and simply holding ALT and double-clicking the file of your choosing. That will make the properties appear.

The other way involves clicking on the file, actually selecting it – not just hovering over it – and then simply pressing ALT+ENTER. Now, I prefer this ALT+ENTER method because it allows me to step through files using the arrow keys, and then when I get to the file I want to see, I just press ALT+ENTER.

And, as always guys, if you have any comments or questions, please feel free to leave them below – I’ll be happy to answer them.

Credit

Thanks to Marc K. for bringing the ALT double-click trick to my attention.

As much as I currently enjoy Facebook, I’ve been known to disable my account every now and then. I never considered this a big deal, as I knew it would remain dormant until I decided I wanted to return. Right now, I’m in one of my active phases, and don’t plan on leaving anytime soon. Despite this fact, I recently found myself visiting the deactivate page, purely out of boredom. In doing so, I unexpectedly came face-to-face with an amusing attempt at manipulation:

Instead of just telling how the deactivation will affect the data I’ve shared, they go as far as saying that my friends will miss me. They don’t have a true sense of how significant Facebook is in my life, so the statement comes off as silly. Am I disappearing from the face of the Earth? No, I’m just disabling Facebook, and I will continue to be alive and reachable.

The specific friends that Facebook decided to show are also interesting – they appear to be purely random, not really factoring in how I use Facebook. If at least it showed the people I spoke to the most, then being warned about them missing me might actually mean something. After all, I’d be disabling a communication medium that had been used regularly with those specific people. But no, every time I visit the page, a random set of friends will miss me.

Furthermore, notice how the first friend listed has a photo with two people, instead of just one? That’s actually not the person’s profile photo, but instead a picture of her with me. We went on a trip together many years back, and it seems that Facebook is going the extra mile to further showcase the friendship that is at stake. Crafty.

It’s interesting to see how far Facebook will go to secure their ad revenue, and keep their userbase large. Surprisingly, according to a presentation Luke Wroblewski attended, it actually works:

looked at deactivation page and adjusted it convince people to stay by adding pictures of friends. Had a big impact, kept 1 million people a year on the site.

I’ve been using Google+ for about two days now, and I have to say – I’m impressed. While they certainly still need to iron out a few things, I’m happy to see they’ve put some serious thought into polishing the social experience. While testing out some of their features, I noticed a “Feedback” button that appeared on the bottom right of all their pages. When I clicked it, I expected to see a fairly standard feedback form, where I could describe the problem, and then submit. Boy, was I wrong.

 

Sure, the feedback form was there – but they also added the ability to highlight or black out elements of the page. With the highlighting controls, you can easily point out the area you’re commenting about, while also providing additional information, if needed. Furthermore, if you’re concerned about privacy, no problem… just black out the information you consider sensitive. Altogether, I find this a refreshing new approach in the process of collecting user feedback, one that also has interesting possibilities. For example, Google could potentially compile statistics about the most highlighted page elements, which could give them a great high-level view of what people are talking about the most. Are they doing that? Who knows – I just know that I’d like having that data to work with, from a development perspective.

By the way, if you’d like an invite to Google+, simply contact me at mref…@gmail.com. Once invited, you might have to wait a little longer to be allowed in, but at least your place will be reserved.

I recently returned from a whopping two month stay in Atlanta, Georgia, where I lived with my sister. The trip, as a whole, proved extremely valuable – I had a lot of fun, and benefited from a refreshing change of atmosphere. I returned feeling better than I had in years, and that gave me a great boost towards beginning work as a freelance web developer. In fact, I am currently working full time on my own for-profit web application, one that I aim to release by the end of July. I’ll likely write more about this project and my Atlanta experiences in a later post, but today, I have one negative (but amusing) Atlanta experience that I’d like to share. It lies in the fact that I was still using my cell phone to communicate with people in Montreal, in addition to Skype. Cell phones rates are pretty expensive when you’re away from home, so I had purchased travel packs before even getting there.

One day, I had to call my cell phone provider to have them re-apply a travel pack, as the first month had expired. I knew exactly what I wanted: 100 minutes for 50$ (the best offer they have, believe it or not), and so I asked for it shortly after authenticating with them. Upon hearing my request, the agent remained silent for a few moments, it seemed like he was looking into it on his end. After a few seconds, he said – you know what? Instead, how about 100 minutes for 40$? I immediately laughed and questioned the motivations behind the rebate. In response, he mentioned that I had been a valued client to them for a long time, and they wanted to show their appreciation. With this, I agreed, and proceeded to discuss other things with the agent. It wasn’t an overly generous offering to their loyal clients, but I figured 10$ was better than nothing.

Before ending the call, a question surfaced in my mind, and I decided to ask the agent. Being already familiar with my 100 minutes for 50$ plan, I knew that if I bypassed 100 minutes, the rate would remain at 50 cents a minute. I liked the simplicity in that – no need to worry about bypassing the 100 minutes. Given the fact that I had just agreed to 100 minutes for 40$, I wondered what would happen beyond the limit. Would my rate be 40 cents, instead of 50 cents? The agent told me he’d have to verify, and after about 15 seconds, he mentioned that the rate would be 98 cents.

Wait, what? Yes. NINETY. EIGHT. CENTS. Nice try, agent, nice try – but with those words he revealed the concentrated evil behind the 40$ deal. By failing to mention that crucial detail, he almost got me to accept a pretty bad offer. After the reveal, he did mention that the 40$ deal would be best if I knew I was going to remain under the 100 minutes – but I could detect that he was uncomfortable. He asked if I felt I would remain under 100, to which I said I would very likely go over. I told him to instead sign me up for the 100 minute for 50$ plan, and ended the call shortly thereafter.

A few things bothered me about this call, beyond the obvious deception that I almost fell victim to. First, if the agent had looked at my previous month’s usage, he would have seen that I went far beyond the 100 minute limit. From the way he spoke, and the questions he asked, it seemed like he truly didn’t know. The 40$ travel pack wasn’t a good match for me, and my usage would have reflected that.

Beyond that, the agent failed to mention the full terms of the agreement. Whether the agent knew or not, this is a very important part of completing a verbal agreement. I usually have the habit of repeating everything I am told throughout the call, and confirming yet again that I understood the details correctly. This time, I didn’t, and it almost cost me… but thankfully my curious nature saved me in the end.

Finally, despite being uninformed about account history, and leaving out crucial terms in the agreement, it was all wrapped in a “you’re a valuable customer, and we want to show our appreciation” box. That, to me, is a tangy mix of incompetence and evil, to the point where I can’t help but see humor in it.

Photo credit

First photo by Elvert Barnes.

Second photo by Gunnar Wrobel.

For a while, the concept of a spoiler was fairly new to me. I knew exactly what it meant, but had never really seen what damage they could do firsthand. Then, in college, I once accidentally revealed a critical plot twist in the Max Payne 2 storyline. My friend’s disappointed reaction was enough to burn the moment in my mind, ensuring that I would never slip up again. I began to be extremely conscious about what I said, knowing that any information revealed on my part might impede the person’s ability to fully enjoy the media.

Currently, there are numerous solutions to help people deal with spoilers online – but the one I’d like to share today tailors specifically to YouTube videos. Meet NoSpoiler.com – feed it a link to a YouTube video, and it’ll generate a NoSpoiler.com link that can be used to show just the video, set to a black background. No comments, no related videos – nothing but the content, unhindered by visual distractions, and with no threat of spoilers. The link can then easily be shared, allowing users to send videos to each other without worrying about spoilers.

Try it out: NoSpoiler compared to YouTube.

At first, I actually thought they were still loading YouTube, hiding all elements except the video – but it turned out to be even simpler than that. It looks like all they’re doing is taking the unique ID:

http://www.nospoiler.com/y/zj2Zf9tlg2Y

…and generating the required embed code to display a stand-alone YouTube player. Clever!

Historically, I’ve always used RetailMeNot for my coupon code needs, as I knew of no viable alternatives. When Coupon Chief contacted me to know if I would review their site, I was glad to agree – after all, competition always tends to produce better products, overall. Before I continue, I want to be clear about the fact that Coupon Chief is paying me to write the review below. Despite their sponsorship, rest assured – the review represents my own honest, unbiased opinion.

Presentation

My first impression of their website was a positive one, thanks to a very clean design, and no visible ads. The content featured on the main page is well placed, and represents what I think will be the most practical shortcuts for users. The search feature is also prominent, and instead of using a proprietary search engine, it utilizes the Google Custom Search. Google’s prowess in the search market is widely known, so I have no doubt in the effectiveness of the search feature.

While Coupon Chief does not currently have ads on the front page, they do feature them on store, coupon, and search result pages. Largely text-based, these ads all seem to be respectfully placed, and currently do not obstruct the user experience. As necessary as advertisements are, I feel caution is necessary to ensure they don’t end up harming the user experience. I’m glad to see that Coupon Chief did this tastefully.

Rating: 4/5

Features

Considering the simple nature of copying a coupon and using it towards a purchase, I approached Coupon Chief expecting to do just that. Sure enough, using the site can be as simple as that – but I was happy to see that they also made a few unique additions.

A feature called Coupon Pulse provides users with a statistical breakdown of the coupon’s success. The color coding makes it easy to quickly determine the general health of the coupon, while also offering specific details should the user be interested. I really appreciated this feature, and felt it was a definite improvement over having just a percentage success rate.

There is also a way for users to get e-mail notifications whenever a coupon is added for a particular store, or a particular tag. I like that this is completely customizable, with fairly generous alert limits (12 stores, 12 tags). I wasn’t able to find a similar feature on the RetailMeNot side – all they offer is a global newsletter that showcases the most popular coupons, which Coupon Chief does also.

For those looking to for extra income, Coupon Chief offers an intriguing feature known as “Pays-2-Share“, which rewards users when the coupons they uploaded are used by others. According to the description, every time someone uses a coupon you’ve uploaded, 2% of the sales are awarded – up to a max of 25$ per store, per month. I was unfortunately unable to try the “Pay-2-Share” feature, as I am not a U.S. resident; however, I really like the idea of paying users, as it could potentially drive merchants to make their coupons easily accessible. Also, the efforts of regular, every day individuals would be rewarded.

“Coupons-4-Causes” is another promising feature, allowing users to contribute to charities whenever they use Coupon Chief coupons. Coupon Chief states that they’ll donate up to 20% of the purchase price to the charity, school, or church of the user’s choosing.

In the future, I’d like to see them release power tools, further facilitating the process of exploiting online coupons. For example, a browser extension that is able to automatically look up websites, as RetailMeNot currently offers.

Rating: 4/5

Usability

Given the simplicity behind the concept of copying coupon codes, one would expect that using such a website would be obvious, and it usually is. Yet, in the top right corner of their menu, Coupon Chief has a helpful “How it works” page. When visited, the user is presented with a video tutorial that explains how to use the site efficiently. For further detail, there is a clear list of steps right below that video, further explaining how it all works. I really like it when sites do this, as what is obvious for one user may not be for another.

In general, I found that Coupon Chief was pretty good in terms of usability. I only spotted one problem throughout my review: When reviewing coupon entries, I noticed that the name of the user was preceded with an image that included a color code in the top left corner. At first glance, I wasn’t sure what this image meant; however, when I hovered over it, the tool tip revealed that it was a user trust score of sorts. That explained it to me, but I still felt like it could have been represented in a better way. Perhaps the avatar and trust score would be better if kept separate, as in some cases, the color code might blend too well with the avatar, making it difficult to see.

 

Rating: 4/5

Security

Whenever I encounter a new website, I typically lookup the domain on Web of Trust, to get a sense of what the public already thinks about it. In this case, Coupon Chief has a fairly negative reputation, but I think I understand why. The problem seems to be that users can submit coupons, and along with them, links to other websites (domains). The submitted websites could potentially be malicious by nature, or simply have shady practices. There needs to be some sort of a system in place to ensure that such domains are rejected.

As a test of my theory, I tried to see if I could create a completely bogus (and harmless) coupon, associated with mattrefghi.com. Sure enough, I was able to do so – and it immediately was allowed to show up in the search results. I feel that there should be a validation procedure, automated or not. Otherwise, I can see users potentially getting spyware, or even viruses by clicking links submitted by certain malicious users. Now, users do have a “Trust score” on Coupon Chief, and that’s a good step; however, I feel it needs to be exploited further. For example, if the trust score is bad enough, maybe coupons from that user should require validation before appearing on the site.

Coupon Chief also currently has problems with comment spam, as it allows any users to post comments under coupons, without a CAPTCHA, or any detectable form of moderation. I feel they need to implement some counter-measures here, to ensure the quality of their service isn’t compromised.

Rating: 2/5

Stability

In general, Coupon Chief runs pretty smoothly – I only encountered two minor issues when reviewing it, and felt only one was worth mentioning here.

I found certain cases where the coupon code itself is partially obstructed by the scissors icon, preventing users from reading it fully. Clicking on the coupon will still launch another window, and will apply the right code. However, if a user tries to do it manually, he may think the code doesn’t work, when in reality, he likely just didn’t see the last letter.

I found this issue while using Google Chrome 10.0.648.204, so it may not be reproducible in other browsers. Also, it seems that it doesn’t always occur – sometimes the scissors don’t overlap, and you see the code properly.

Rating: 4/5

Consensus

Coupon Chief is a welcome addition to the world of coupon codes, introducing unique new features, and an attractive way to get paid for submitting content. The security problems I noted earlier are my only concern at the moment, so until they correct those issues – I suggest sticking to well known stores and coupons within the site.

Rating: 6.4/10

As part of my regular use of Gmail, I often find myself pasting text from web into my e-mails. Since the Gmail editor supports rich-text, pasting generally includes the formating, which, most of the time, simply does not make sense within the e-mail. For years, I have been using a trick to get around this – one which involved using the almighty Windows Notepad. By simply pasting the text into Notepad, and then copying it from there, I make sure the formating is not brought over. This works because Notepad itself does not support formating. As useful as this trick is, I often found myself wondering whether there were better options available.

A few days ago, as I was writing an e-mail to a prospective client, I made the mistake of writing it in Google Docs, and then copying it over to Gmail. With the Notepad trick applied, I would have been fine – but it slipped my mind in this occasion. Copying text from Google Docs had one immediate effect – it meant the Google Docs font would be used in the Gmail Editor. In itself, not a problem – but as I continued working on the e-mail, I found myself copying another specific subset of the Google Doc, and pasting it in the middle of the e-mail. All looked fine within the editor, but after it was sent, one flaw was made immediately apparent:

Notice the unnecessary extra spacing? It appeared immediately after the content I pasted from Google Docs. To make matters worse, part of my e-mail explained how I put emphasis on perfecting the content I produce. Words cannot express how infuriating it is for a perfectionist to express his perfectionism, only to realize he sent an obviously imperfect e-mail.

I immediately sought to find a solution, once and for all, to ensure I never make such a mistake again. After some searching, I discovered that the good folks at Google already took steps to fix this browser “feature”. While using Google Chrome, one can simply press CTRL + SHIFT + V to paste without formating. Since Google Chrome is my browser of choice, this covers 90% of my use cases, making it a solid solution. Hopefully other browsers will start implementing similar features, permanently resolving the issue.